xtremerat | 30a5d79a63e5394df30cdc72930689bc4fbedfca61b9dde39a911d2dbe3913de

General

Target

JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe
Size

548KB
MD5

3be3123c68b0565c89c84bfb880aa102
SHA1

c878c035d4f4b33abd4f4d525ec2d725934252de
SHA256

30a5d79a63e5394df30cdc72930689bc4fbedfca61b9dde39a911d2dbe3913de
SHA512

5e60b5d588076ea0b1be3d5cc88470561d6c0a6be648f75df7641bb0afb0ef2e490825ad95293be4c3beeb7b9001a1a3dab7fe094915850e3a6b1fb60fa10e11
SSDEEP

12288:6GuWm0QRVRdgFkEXIc0pg3xTX2ep3vWQrWK0D95:Xc7dgadoTXFdeaWd

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

harem.zapto.org

Signatures

Detect XtremeRAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/3968-15-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3968-17-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/2084-19-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{32WKMIH1-IVI0-F0F2-7B17-7AR8O8KDSOJQ}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32WKMIH1-IVI0-F0F2-7B17-7AR8O8KDSOJQ}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart"	server.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe

Executes dropped EXE 1 IoCs

pid	Process
2084	server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe"	server.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	server.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1496-0-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-1-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-6.dat	upx
behavioral2/memory/2084-13-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3968-15-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3968-17-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/1496-18-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/2084-19-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/1496-20-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-22-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-24-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-26-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-28-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-30-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-32-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-34-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-36-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-38-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-40-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1496-42-0x0000000000400000-0x0000000000596000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4468	3968	WerFault.exe	90
5108	3968	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1496	JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe
1496	JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1496	JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4240	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4240	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1496	JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe
1496	JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe
2084	server.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2084	1496	JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe	88
PID 1496 wrote to memory of 2084	1496	JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe	88
PID 1496 wrote to memory of 2084	1496	JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe	88
PID 2084 wrote to memory of 3968	2084	server.exe	90
PID 2084 wrote to memory of 3968	2084	server.exe	90
PID 2084 wrote to memory of 3968	2084	server.exe	90
PID 2084 wrote to memory of 3968	2084	server.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3be3123c68b0565c89c84bfb880aa102.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe" cd$
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 480
      4⤵
      Program crash
      PID:4468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 476
      4⤵
      Program crash
      PID:5108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x46c 0x3d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3968 -ip 3968
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3968 -ip 3968
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MMBPlayer\server.exe

Filesize
33KB

MD5
a6b4f42e114ddc9ca5a6954b44398a9b

SHA1
3f4dfba34ae1d006317b21b7a1ebeba434cdc17a

SHA256
0592b8492c7d0560b63ba758c960210d99bdf31b373d51fc1d7827f2b1ba677c

SHA512
12f8777cacc4834926409f46fbc9e1e12f29f11e370418aa9068c6932df01267be0704971bf7faecf61808447ee3c1d64718b3287f0d32b3aefa19c12076ddee

Download Submit
memory/1496-34-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-26-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-42-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-24-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-40-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-18-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-38-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-20-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-1-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-22-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-36-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-28-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-30-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-32-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1496-0-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2084-19-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2084-13-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3968-15-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3968-17-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads